Deploy your applications with Easypanel on a VPS

Easypanel positions itself as a modern, visual alternative to CapRover or Dokku. It relies on Docker and Nixpacks to automatically build your applications from a Git repository, without you having to write a Dockerfile. Its interface, more recent and more ergonomic than most open-source panels, lets you manage applications, databases, certificates and domains in a few clicks. Easypanel natively integrates Traefik as a reverse proxy: each deployed application automatically gets its Let's Encrypt certificate and its routing. It's an excellent compromise between the simplicity of a commercial PaaS and the control of a server you own, particularly well suited to agencies that regularly deploy client projects.

Easypanel bundles Traefik and a Nixpacks builder, which requires a bit more memory than Portainer.

RAM: 2 GB minimum, the requirement stated by the vendor. As soon as you host several applications with their databases, aim for 4 GB: Nixpacks builds temporarily consume a lot of RAM and a small server risks killing the compilation process mid-way.

CPU: 1 vCPU is sufficient to start, 2 vCPU recommended as soon as you run frequent builds or resource-intensive databases.

Disk: plan for at least 30 GB of SSD. Plan for more if you host large databases or heavy Docker images (Node, Java).

OS: Clean Ubuntu 22.04 LTS or Ubuntu 24.04 LTS with root access. The official script targets Ubuntu: when Docker is missing, it installs it from Docker's Ubuntu repository. Docker is installed automatically by the Easypanel script — no need to pre-install it.

Network / DNS: configure an A record for the panel domain (panel.mydomain.com) pointing to your VPS IP. A wildcard record *.mydomain.com is strongly recommended to avoid manually adding each application subdomain. Ports 80 and 443 must be free (the script stops if a service already uses them) and open in your firewall. The panel listens on port 3000 for first access; once its domain is configured, disable IP access rather than relying on ufw, which does not filter ports published by Docker.

Easypanel exposes Traefik via two entry points: the Traefik dashboard (disabled by default for security reasons) and the internal routing API that the panel manages automatically. You normally do not need to touch the Traefik configuration directly.

Automatic TLS. For each domain added in the Domains tab of a service, Easypanel configures an ACME Let's Encrypt resolver. The certificate is renewed automatically before expiry. If your domain is behind Cloudflare, make sure the SSL/TLS mode is set to Full (strict) — a "Flexible" mode would cause an infinite redirect loop since Traefik already redirects HTTP to HTTPS.

Advanced configurations. From the tabs of each service, you can:
- add Traefik middlewares to a domain (Domains tab) or HTTP Basic authentication (Security tab);
- mount persistent volumes (Storage tab, useful for data in applications that do not use a dedicated database);
- set the number of replicas and zero-downtime deployments (Advanced tab).

Internal port. Each domain routes to a target port, which must be the port the application listens on inside the container (normally on 0.0.0.0). If your application listens on a non-standard port, set it as the domain's target port (Domains tab) so that Traefik knows where to route requests.

Updating Easypanel. The panel checks for updates itself: when a new release is available, a button appears in the navigation bar. From the command line, the manual update documented by the vendor (stable channel) is:

docker image pull easypanel/easypanel && docker service update easypanel --force

Do not re-run the installation script to update: it is meant for a fresh server, stops when ports 80 and 443 are in use and runs docker swarm leave --force.

Backing up the panel state. Easypanel stores its configuration, the Traefik configuration (certificates included) and service data in the server's /etc/easypanel directory, mounted into its containers. To back up everything:

# Measure Easypanel's state directory
du -sh /etc/easypanel

# Archive it (the archive contains secrets: protect it)
tar czf /root/easypanel-backup-$(date +%Y%m%d).tar.gz -C / etc/easypanel \
  && chmod 600 /root/easypanel-backup-*.tar.gz

Then copy the archive off the server. Files of a database being written may be inconsistent in it: for databases, rely on their logical backups.

Application database backups. Easypanel offers scheduled logical backups for PostgreSQL, MySQL, MariaDB and MongoDB (not Redis). First declare a destination in Settings → Server → Storage Providers: an S3 or S3-compatible bucket (Cloudflare R2, Backblaze B2, Wasabi…), SFTP, Dropbox or Google Drive. Then configure the backup from the Backups tab of each database service: cron schedule, number of backups kept and destination path. Run a first backup manually and test its restore.

Restoring. To restore the state directory archive on the server:

tar xzf /root/easypanel-backup-20261001.tar.gz -C /

Port 80 or 443 already in use. If the installation script stops on "something is already running on port 80" (or 443), check which service is listening on those ports: ss -tlnp | grep -E ':(80|443)'. A pre-installed nginx or Apache on the VPS blocks the installation. Stop and disable the competing service (systemctl disable --now nginx) then re-run the installation script.

Docker not installed or version too old. The script only installs Docker when it is missing: on a system that already has an old Docker version, it keeps it as is and you may get compatibility errors. Check the version: docker --version, and compare it with the latest stable Docker Engine release. If necessary, uninstall the old version and re-run the script.

DNS not propagated — SSL certificate not found. If Let's Encrypt cannot verify the domain (DNS record not yet propagated, or long TTL), Traefik will show a certificate error. Check propagation from your terminal: dig +short panel.mydomain.com must return your VPS IP. DNS propagation can take a few minutes to several hours depending on the registrar and TTL.

Certificate error after IP change. If you migrate your VPS to a new IP without updating DNS, the ACME challenge fails. Update your A record, wait for propagation, then run the server IP refresh from the server settings, which updates the recorded IP, the generated domain and the certificates.

Nixpacks build fails out of memory. On a small VPS (2 GB of RAM), Node.js builds or multi-stage images may fail silently. Add swap to absorb peaks: fallocate -l 2G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile. Make swap persistent by adding /swapfile none swap sw 0 0 to /etc/fstab.